PT-2025-12194 · Pytorch · Pytorch

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-7804

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pytorch/pytorch versions <=2.3.1

Description A deserialization vulnerability exists in the Pytorch RPC framework, allowing an attacker to execute arbitrary code remotely by sending a malicious serialized PythonUDF object. This flaw leads to remote code execution on the master node due to the lack of security verification during the deserialization process of PythonUDF objects in pytorch/torch/distributed/rpc/internal.py.

Recommendations For versions <=2.3.1, update to a version greater than 2.3.1 to resolve the issue. As a temporary workaround, consider disabling the use of PythonUDF objects in the torch.distributed.rpc framework until a patch is available. Restrict access to the torch.distributed.rpc module to minimize the risk of exploitation. Avoid using the PythonUDF object in the affected API endpoint until the issue is resolved.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-7804

GHSA-4VMG-RW8F-92F9

Affected Products

Pytorch

References · 11

• https://osv.dev/vulnerability/GHSA-4vmg-rw8f-92f9 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-7804 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-7804 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-7804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7804 · Security Note
• https://github.com/pytorch/pytorch · Note
• https://github.com/pytorch/pytorch/security/policy#using-distributed-features · Note
• https://github.com/pytorch/pytorch/blob/27a14405d3b996d572ba18339410e29ec005c775/torch/distributed/rpc/internal.py#L162 · Note
• https://twitter.com/CVEnew/status/1902670963839566089 · Twitter Post
• https://huntr.com/bounties/0e870eeb-f924-4054-8fac-d926b1fb7259 · Note
• https://twitter.com/CveFindCom/status/1902671309282361814 · Twitter Post